linux-kernel - Re: [PATCH] mm/hmm: Allow hmm_dma_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63702a66-4cc6-4562-89f4-857fe3f044e8@gmail.com>
Date: Sat, 24 May 2025 00:38:43 +0900
From: Daisuke Matsuda <dskmtsd@...il.com>
To: Christoph Hellwig <hch@...radead.org>
Cc: linux-rdma@...r.kernel.org, linux-mm@...ck.org, leon@...nel.org,
 jgg@...pe.ca, akpm@...ux-foundation.org, jglisse@...hat.com,
 linux-kernel@...r.kernel.org, linux-pci@...r.kernel.org, zyjzyj2000@...il.com
Subject: Re: [PATCH] mm/hmm: Allow hmm_dma_map_alloc() to tolerate NULL device

On 2025/05/23 23:48, Christoph Hellwig wrote:
> On Fri, May 23, 2025 at 02:35:37PM +0000, Daisuke Matsuda wrote:
>> Some drivers (such as rxe) may legitimately call hmm_dma_map_alloc() with a
>> NULL device pointer,
> 
> No, they may not.  If something has no device with physical DMA
> capabilities, it has not business calling into it.
> 

Hi Christoph,

RXE is a software emulator of IBTA RoCEv2, designed to allow systems equipped with standard Ethernet adapters to interoperate with other RoCEv2-capable nodes.

Like other Infiniband subsystem drivers (under drivers/infiniband/{hw,sw}), RXE depends on the ib_core and ib_uverbs layers in drivers/infiniband/core. These common RDMA layers, in turn, rely on the HMM infrastructure for specific features such as On-Demand Paging.

As a result, even though RXE lacks physical DMA capabilities, it still needs to interact with hmm_dma_map_alloc() through the shared RDMA core paths. This patch ensures that such software-only use cases do not trigger unintended null pointer dereferences.

Thanks,
Daisuke